Anthropic built an agent stack with your phone as the control plane

Anthropic shipped computer use for Claude Cowork and Claude Code this week — research preview, macOS only, available to Claude Pro and Max subscribers. The announcement is being covered as a capability story, which is technically accurate but misses what's actually interesting architecturally. What Anthropic built is a three-layer agent stack that treats your phone as a control plane and your desktop as compute.

Here's how the layers fit together. Dispatch — announced last week and now available in both Cowork and Claude Code — is the routing and orchestration layer. It gives you one continuous conversation thread that syncs across phone and desktop. You assign a task from your phone, Claude runs it on your Mac, you get a push notification when it's done. Felix Rieseberg, member of technical staff at Anthropic, announced Dispatch on X as "one persistent conversation with Claude running on your computer — message it from your phone and return later to finished work." Cowork is the second layer: an isolated VM where Claude handles knowledge work — documents, spreadsheets, research tasks. The third layer is computer use, which runs outside that VM on your actual desktop. That last part matters for security reasons.

The connector-first execution model is where Anthropic made a deliberate architectural choice. Per the Anthropic documentation, when you assign a task, Claude follows a specific priority order: first it tries connectors to services like Slack or Google Calendar, then direct browser control, then full screen control as a last resort. "Pulling messages through your Slack connection takes seconds, but navigating Slack through your screen takes much longer and is more error-prone," the docs note. Screen control is the fallback, not the feature. That framing runs counter to how most outlets covered this.

The MacStories hands-on review, which tested Dispatch with a range of tasks, puts it bluntly: "about a 50/50 shot whether what you try will work." The task table is instructive — Dispatch found files, summarized emails, and handled Notion queries, but failed on opening Mac apps directly, Terminal sessions, iMessage sends, and Todoist integration (authorization error). That failure mode matters for the connector-first framing: the connector surface area is the bottleneck. When a connector exists, it works. When it doesn't, you're at the mercy of screen control reliability.

The session routing inside Dispatch is clean infrastructure. When you assign work through the thread, Claude classifies it and spins up the right session type — development tasks go to Claude Code, knowledge work to Cowork. Those sessions show up in their respective sidebars. Per Anthropic's Dispatch docs, Claude "messages you the outcome — a spreadsheet, a memo, a comparison table, a pull request — rather than showing you every step of the process." That's the right UX model for async agent work, though it also means debugging failures is harder when you weren't watching.

The plugin and scheduling story is real infrastructure too. Dispatch supports recurring tasks: tell Claude once to check email every morning or pull metrics every week, and it runs without being asked again. Cowork's plugin system is MCP-backed YAML — skills, connectors, and sub-agents — with org-wide sharing on the roadmap. Scheduled tasks in Claude Code already have an open issue against them: GitHub issue 35280 documents zombie sessions that persist after scheduled work completes, requiring manual cleanup each morning. The issue author tried prompt-level workarounds and found them ineffective — this is a platform-level bug, not solvable via prompt engineering.

Security is where the architecture gets complicated. Computer use runs outside Cowork's isolated VM — meaning Claude is interacting with your actual desktop and apps, not a sandbox. Anthropic's safety documentation is unusually candid about this: "Computer use runs outside the virtual machine that Cowork normally uses for working on your files and running commands. This means Claude is interacting with your actual desktop and apps, rather than an isolated sandbox." Anthropic's mitigation is activation scanning (the system scans model activations in real time to detect prompt injection attempts), a per-app permission model that requires explicit approval before Claude touches each application, and a list of apps that are off-limits by default. But the docs also acknowledge that "actions taken in one app can impact other apps" — clicking a link in your email client might open Chrome even if you haven't granted Claude permission to use Chrome. The blast radius isn't fully contained.

For enterprise, Anthropic doesn't pretend the current feature set is ready. There's no audit log, no HIPAA certification, no FedRAMP or FSI approval. The docs recommend against using computer use with healthcare, financial, or other sensitive personal records. That's a clear signal this is a consumer and prosumer product right now. The honest enterprise read: file this under "watch for when they add audit logging and compliance certifications," not under "deploy today."

For context on what was shipped: Cowork itself was built by Claude Code. Axios reported in January 2026 that almost all of Cowork's core code was autonomously generated by Claude Code in 1.5 weeks, per Boris Cherny, who leads Claude Code at Anthropic. Dispatch and computer use were then built on top of that infrastructure. The recursive quality of it — Anthropic's agent workspace, written by Anthropic's coding agent, now routing tasks through a mobile control plane — is either poetic or vertigo-inducing depending on your risk tolerance.

9to5Mac noted that Anthropic is doing what OpenClaw pioneered — agentic desktop control — with Perplexity Computer and Meta's Manus also active in the same space. What's architecturally distinct here is that Anthropic has an explicit opinion about execution order — connectors first, screen control last — and a routing layer that treats phone-to-desktop handoff as infrastructure rather than a demo feature. Whether the connector surface area ever gets broad enough to make screen control a genuine last resort rather than a frequent fallback is the question worth watching.

Computer use in Cowork and Claude Code is available now in research preview on macOS. Anthropic's launch announcement specifies both Claude Pro and Max subscribers; the Cowork support docs reference Pro. If the tier distinction matters for your deployment, check the current support documentation directly — the entitlement scope may tighten as this moves out of research preview.